12/06/2013 | Surveillance -Should the government know less than Google?

The Economist Staff

LET'S get the most contentious point out of the way first: Edward Snowden made the right call to make public the extent of the National Security Administration's surveillance of electronic communications.

The American people can now have a debate about whether or not they consent to that level of surveillance in order to prevent terrorist attacks, a debate that we were previously denied by the government's unwillingness to disclose even the broad outlines of what the NSA was doing. There may be some slight risk that knowing more about the breadth of NSA surveillance will lead terrorists to take better precautions in concealing their communications. But that risk seems manageable, and is of far less importance than the ability of Americans, and the rest of the world for that matter, to finally have an honest discussion about how much we think our governments should be able to see of our online behaviour.

So how much access should governments have? Here are a few things to consider:

1. Google's servers have been reading the content of Gmail users' e-mails since the service debuted, in order to serve up user-appropriate advertising and to block spam. Microsoft, Yahoo and all the other major search and e-mail providers do more or less the same thing. If you've watched a YouTube video about barbecue grilling techniques and then you write an e-mail to friends inviting them over for burgers, you should not, in this day and age, be surprised to see an ad for a Fire Magic Aurora 660s portable gas grill pop up in your browser. Google knows what you've been viewing and writing on the internet, and it is happy to sell this knowledge to third-party companies that are looking for consumers like you.*

2. Imagine that rather than watching videos about barbecue grilling techniques on YouTube, you have instead been watching videos of beheadings in Pakistan, accompanied by romantic footage of black-flag-waving horsemen riding to re-establish the caliphate. Let's say you then write an e-mail to your brother saying you've acquired most of the materials to assemble the package, except you can't find an affordable pressure cooker. Is it acceptable for Google to contract with Williams Sonoma to send you an advertisement for an affordable pressure cooker based on its knowledge of your viewing habits and the contents of your e-mails? (This is currently the foundation of an entire global industry, so deciding it's not acceptable would have serious economic consequences.)

3. And now the key question: is it okay for Google to use knowledge it gains from searching your e-mails to sell advertising to Williams Sonoma, but not to pass it on to the government when it asks for matches between pressure cookers and beheading videos?

4. This is not a facile question. Many things are legal for private parties but not for the government; maybe this should be one of those things. Or maybe we could decide that it's acceptable for Google to contract browser ads based on user information, but not to pass that information on to third parties, be they private companies or the government, without the user's consent. In that case the government would only be able to ask Google for information on users who have consented to the searches. On the other hand, technical workarounds might render this sort of user-consent mandate irrelevant. And efforts to preserve user anonymity based on demanding consent generally don't work. People usually end up clicking "yes" at some point for something, meaning any privacy guarantees become purely theoretical and functionally irrelevant. The European Union's requirement that websites ask for specific consent before accepting cookies, for example, is a ridiculous time-waster that has accomplished little more than forcing Europeans to spend more of their life's precious seconds clicking useless pop-up windows.

Here's the basic point. In the online world, essentially everything we do is always being archived and searched by the companies that provide us access. There was a time when we might have asked whether those companies should be barred from using that behavioural information for commercial purposes, but that ship sailed long ago. The question we're asking now is whether the government should be allowed to gain access to those private search archives for national security purposes. The government isn't spying on us; Google is spying on us, and the government is asking Google for certain results.

We need to think coherently about what we find scary here. The problem isn't so much that we haven't set up a legal architecture to preserve our online privacy from the government; it's that we haven't set up a legal architecture to preserve our online privacy from anyone at all. If we don't have laws and regulations that create meaningful zones of online privacy from corporations, the attempt to create online privacy from the government will be an absurdity.

*To be clear: Google doesn't give the information itself to third parties. It sells its tailored ad-placement and other services to third parties, based on the knowledge it has of user behaviour and preferences. Google's privacy policy is here.